DialogHandler Parameters Tampering Vulnerability (CVE-2026-13188)

Updated on Jul 22, 2026

Description

June 2026 - CVE-2026-13188

• Progress® Telerik® UI for AJAX 2026.2.519 or earlier.

What Are the Impacts

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient integrity protection of dialog request parameters may allow an attacker to alter server-side dialog processing and support chained exploitation.

Is My Application Vulnerable?

Your application may be vulnerable if all of the following are true:

• RadEditor or RadFileExplorer is used in the application.
• Telerik.Web.UI.DialogParametersEncryptionKey is set in web.config, or machineKey is not explicitly configured.

Issue

• CWE-345: Insufficient Verification of Data Authenticity
• CAPEC-153: Input Data Manipulation

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2011.2.712 && <= 2026.2.519 (2026 Q2)	>= 2026.2.708 (2026 Q2 SP1)

Follow the update instructions for precise instructions. All customers who have a license for Progress® Telerik® UI for AJAX can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following measures to reduce risk.

The RELEVANT_KEY references below refers to any of Telerik.AsyncUpload.ConfigurationEncryptionKey, Telerik.Upload.ConfigurationHashKey, or Telerik.Web.UI.DialogParametersEncryptionKey in web.config.

Using v2026.2.514 and earlier:

• Vulnerable Scenario 1 - If you are using a RELEVANT_KEY in web.config
  1. Remove RELEVANT_KEY from web.config, to fall back on MachineKey.Unprotect with AES + HMAC
  2. Continue to Instructions - Generating Strong Machine Keys section
• Vulnerable Scenario 2 - If you are not using RELEVANT_KEY
  1. Continue to Instructions - Generating Strong Machine Keys section

Using v2026.2.708 and later:

• Option 1 - You can use RELEVANT_KEY again, it provides stronger protection than machineKey, via AES-GCM
• Option 2 - Remove RELEVANT_KEY to use machineKey, while not as strong as GCM, it is useful for webfarm environments, and you can use the "autogenerate keys at runtime" again.

Instructions - Generating Strong Machine Keys

AES + HMAC support and framework-managed key material via machine key config. even a strong custom key will not prevent padding oracle attacks. Critical - You must manually generate the keys in IIS, using the Autogenerate creates the same HMAC guard collapse as #1

1. Open IIS > select your site > select Machine Key
2. Validation method: choose HMACSHA256
3. Automatically generate at runtime checkboxes: uncheck both (important)
4. In the right pane, click Generate Keys 
5. In the right pane, click Apply
6. In the left pane, select Application Pools and recycle the relevant App Pool (important)

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank the researchers at TantoSec for their responsible disclosure and cooperation.

External References

CVE-2026-13188 (Medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS: 5.9 / Medium

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient integrity protection of dialog request parameters may allow an attacker to influence server-side processing.

Discoverer Credit: Marcio Almeida of TantoSec